As a whole, the healthcare industry has gotten better with regard to data security over the past year, says Hewlett Packard Enterprise's 4th annual State of Security Operations Report.
Better technology and process improvement are to thank, said Chandra Rangan, vice president of Product Marketing for HPE Software at Hewlett Packard Enterprise.
"The healthcare industry is looking a lot better than you'd think from a security industry standpoint," Rangan said. "In the last three years, overall maturity has dropped a little, but technology increased.
"There's been a big concern about healthcare not being organized and its reaction to the target on its back," he added. "But the industry has responded. The improvements can be seen in its response to the threat landscape."
The organizations with improved maturity aren't just fixing security posture, but security leaders are addressing how to manage security threats and have changed the business context, Rangan explained. Larger companies are reporting to the board on a quarterly basis. And the IT team is working side-by-side with the CIO to determine the security posture.
Further, the strongest organizations mastered the basics of real-time monitoring and have some basic hygiene, Rangan said. "They're saying: I can catch, contain and stop a threat in its tracks. And they've included a hybrid security model to activate security models that includes automation."
As business maturity increases, it forces a response in all of the other vectors: people, processes and technology, Rangan explained. Healthcare has improved its maturity: The question is how fast and what is rate of improvement?
"The healthcare industry is taking security a lot more seriously," Rangan said. "They're rolling up their sleeves and doing the hard work. It's very positive, as there are other industries that aren't making this change."
Despite this good news, most organizations aren't doing as well as they should, Rangan explained. One in five organizations need better business rules. Further, most are at the ad-hoc piece and have yet to make the necessary changes across the board.
The biggest issue is that organizations are essentially playing the role of firefighter: dealing with security after there's an issue, Rangan said. Maturity levels have dropped in some organizations is that the serious work isn't being done.
"The problem with being a firefighter is you get there after the building is burning," Rangan said. "Some assets are disappearing and you're not able to stop the fire."
In the coming year, Rangan expects threat-hunting will become a major factor in handing security – once organizations become advanced in real-time monitoring. Fusion centers, where organizations share intelligence will also improve maturity levels, as well as a shift into using open source tools for security management.
Twitter: @JessieFDavis
Email the writer: jessica.davis@himssmedia.com
